attest Preview deployments
How Attest discovers and verifies previews.
Attest uses GitHub-visible metadata and explicit administrator configuration. It does not call hosting-provider APIs to discover a preview.
What makes a preview usable?
The preview must be ready, safe to reach and associated with the exact pull request head SHA. GitHub Deployment metadata is the preferred source; commit statuses and Check output can also supply candidates. Bot comments, PR descriptions and explicit URL configuration may provide hints, but a URL alone does not prove which commit it serves.
Missing, unsafe, ambiguous or insufficiently associated candidates cannot produce a pass. Attest waits within a bounded deadline; the default PREVIEW_WAIT_TIMEOUT is 10m for new runs.
Network safety
Attest checks destinations, DNS answers and redirects. Private destinations are blocked by default and require an explicit administrator exception. Loopback, metadata and other prohibited destinations remain blocked. Never let a PR or model decide what private host to allow.
The current browser execution subset requires one HTTPS origin. Cross-origin assets or authentication may fail even when the initial preview is reachable. Use dedicated preview infrastructure and consult the repository's docs/preview-discovery.md for exact supported metadata formats and configuration.